// `selector` fields.
  //
  // A per-namespace parameter may be used by specifying a namespace-scoped
  // `paramKind` in the policy and leaving this field empty.
  //
  // - If `paramKind` is cluster-scoped, this field MUST be unset. Setting this
  // field results in a configuration error.
  //
  // - If `paramKind` is namespace-scoped, the namespace of the object being

message ValidatingAdmissionPolicySpec {
  // ParamKind specifies the kind of resources used to parameterize this policy.
  // If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions.
  // If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied.

		allErrors = append(allErrors, field.NotSupported(fldPath.Child("failurePolicy"), *spec.FailurePolicy, supportedFailurePolicies.List()))
	}
	if spec.ParamKind != nil {
		opts.allowParamsInMatchConditions = true
		allErrors = append(allErrors, validateParamKind(*spec.ParamKind, fldPath.Child("paramKind"))...)
	}
	if spec.MatchConstraints == nil {
		allErrors = append(allErrors, field.Required(fldPath.Child("matchConstraints"), ""))
	} else {

func (in *ParamKind) DeepCopyInto(out *ParamKind) {
	*out = *in
	return
}

// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ParamKind.
func (in *ParamKind) DeepCopy() *ParamKind {
	if in == nil {
		return nil
	}
	out := new(ParamKind)
	in.DeepCopyInto(out)
	return out
}

        "time": "2004-01-01T01:01:01Z",
        "fieldsType": "fieldsTypeValue",
        "fieldsV1": {},
        "subresource": "subresourceValue"
      }
    ]
  },
  "spec": {
    "paramKind": {
      "apiVersion": "apiVersionValue",
      "kind": "kindValue"
    },
    "matchConstraints": {
      "namespaceSelector": {
        "matchLabels": {
          "matchLabelsKey": "matchLabelsValue"

      apiVersions:
      - apiVersionsValue
      operations:
      - operationsValue
      resourceNames:
      - resourceNamesValue
      resources:
      - resourcesValue
      scope: scopeValue
  paramKind:
    apiVersion: apiVersionValue
    kind: kindValue
  validations:
  - expression: expressionValue
    message: messageValue
    messageExpression: messageExpressionValue
    reason: reasonValue
  variables:

      apiVersions:
      - apiVersionsValue
      operations:
      - operationsValue
      resourceNames:
      - resourceNamesValue
      resources:
      - resourcesValue
      scope: scopeValue
  paramKind:
    apiVersion: apiVersionValue
    kind: kindValue
  validations:
  - expression: expressionValue
    message: messageValue
    messageExpression: messageExpressionValue
    reason: reasonValue
  variables:

	"paramKind":        "ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the...

*/

package generic

import (
	"k8s.io/api/admissionregistration/v1"
	"k8s.io/apimachinery/pkg/types"
)

type PolicyAccessor interface {
	GetName() string
	GetNamespace() string
	GetParamKind() *v1.ParamKind
	GetMatchConstraints() *v1.MatchResources
}

type BindingAccessor interface {
	GetName() string
	GetNamespace() string

	// GetPolicyName returns the name of the (Validating/Mutating)AdmissionPolicy,

  // It should point to a resource of the type specified in ParamKind of the bound ValidatingAdmissionPolicy.
  // If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the ValidatingAdmissionPolicy applied.
  // If the policy does not specify a ParamKind then this field is ignored, and the rules are evaluated without a param.
  // +optional